4 ms·
How would it catch something like cp /bin/rm ponies ; ./ponies -rf /
by quarterto 12y ago
How would it catch something like
cp /bin/rm ponies ; ./ponies -rf /
- aioprisan 12y agoor you can create a ponies alias, even more harmless-looking
- icebraining 12y agoThe same way checkinstall detects which files have been installed - it overrides the relevant syscalls when running the program/script: http://asic-linux.com.mx/~izto/checkinstall/installwatch.html http://asic-linux.com.mx/~izto/checkinstall/installwatch.htm... Of course, not everything is as obvious to detect as deleting files :)
- acveilleux 12y agoWell, checkinstall acts at the dynamic linking level. If you use ASM to call the syscall directly (or more generally, a statically linked binary) then checkinstall will not even see it (strace/DTrace/ktrace would.)